options: enable `tls-verify` by default

We shouldn't default to no verification in current year. User can
opt-out if needed.

Keep it disable for builds without libcurl when libavformat is older
than 63.0.100. This is done to match ffmpeg's timeline for enabling
tls_verify by default in lavf, also to ensure we the default verify
locations will be loaded on such version.